Security
How TekkAnimate AI protects your account, data, and creative work.
Last updated: August 4, 2026
Security is built into every layer of TekkAnimate AI. This page describes the technical safeguards we use to protect your account, personal data, payment information, and creative content.
Account Protection
Email-verified login, 7-day soft-delete with restore, and suspicious-signup detection.
Payment Security
Server-side pricing, idempotent webhooks, and JWT signature verification on every transaction.
Credit Integrity
All credit operations run server-side only — balances cannot be manipulated from the client.
Content Moderation
Every prompt is scanned for prohibited content and public-figure impersonation before generation.
Privacy & Isolation
Row-level security ensures you can only access your own projects, media, characters, and credits.
Abuse Prevention
Free-trial eligibility is tracked by normalized email to prevent repeat-claim abuse across accounts.
Server-Side Architecture
All sensitive operations — credit spending, generation, moderation — run exclusively on our servers.
Audit Logging
Security events, moderation decisions, and error logs are persisted for investigation and compliance.
Authentication & Account Security
- Email verification required for all new accounts
- Google OAuth login supported as an alternative to email/password
- Password reset flow with time-limited tokens
- Session tokens managed by the platform's auth backend — never stored in client code
- 7-day soft-delete with full account restore capability
Data Isolation
Every entity in our database is protected by Row-Level Security (RLS). This means:
- You can only read, edit, or delete your own projects, scenes, characters, scripts, and media
- Admin-only entities (moderation logs, security logs, error logs) are invisible to regular users
- Credit transactions can only be created by the server (admin RLS on writes)
- Payment records are restricted to the buyer and administrators
Payment Security
- Product prices are resolved server-side — the client never sends a price
- Payment webhooks are verified with RS256 JWT signatures to prevent forgery
- Order IDs serve as idempotency keys, preventing double-granting on duplicate webhook deliveries
- Subscription cancellations automatically revoke plan access
- Card details are handled entirely by our payment provider — we never store full card numbers
Content Safety
- Server-side moderation engine scans every prompt before generation
- Prohibited content patterns include CSAM, deepfakes, terrorism, violent crime, and more
- Public figure list with realistic-depiction detection prevents impersonation
- File uploads validated for type (JPG/PNG/WebP/GIF) and size (10MB max)
- All moderation decisions logged with user, prompt, and outcome for audit
Abuse Prevention
- Free-trial eligibility tracked by normalized email (lowercase, dot-stripped, alias-stripped)
- Deleted-and-recreated accounts cannot claim a second free trial
- Server-side credit balance verification before every generation
- Automatic credit refunds for failed generations
- Security event logging for fraud, manipulation, and unauthorized access
Reporting a Vulnerability
If you discover a security vulnerability, we appreciate your help in disclosing it responsibly. Please report it through our Contact page with full details. We will investigate and respond promptly. We do not pursue legal action against good-faith security researchers.
Compliance
We continuously monitor evolving data protection regulations and AI safety standards to ensure our platform remains compliant. For details on data handling, see our Privacy Policy. For AI safety practices, see our AI Safety Policy.